Embed Size (px)
Citation preview
From Modelica modelsto dependability analysis
1
Marc Bouissou (EDF)Xavier de Bossoreille (DLR)
LMCS 2015
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Industrial challenge
• Separation of design and dependability analysis workflows
• Consequences:
– The same information is input twice
– Consistence is not guaranteed
– Long delay between the two kinds of studies => no possibility of
feedback, except for very serious issues
• Existing attempts to link design models to dependability:
– Limited to fault tree production (+ FMEA)
– Rely on a simple algorithm (assembly of FT parts, not a true
generation), works for control systems but not for physical systems
– No storage of generic reliability models
2
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Modelica and Figaro: two DSLs
• Modelica: system design and functional validation
– Deterministic physical models: algebraic and differential equations
(DAE)
– Object oriented
– Declarative and procedural parts
– Supported by a large number of tools (open source or commercial)
• Figaro: system dependability analysis
– Discrete stochastic models: states and stochastic transitions
– Object oriented
– Declarative (based on occurrence and interaction rules)
– Supported by the KB3 platform (partly free. Should be open source
soon) 3
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Various ways to derive stochastic models from Modelica models
4
Need for a reliability/availability analysis of a system already modeled in Modelica
Hybrid?Enrich the model with stochastic
transitions and run MCS
Associate system structure to a
FIGARO state based libraryDynamic?
Boolean?
Create a second
Modelica model using
only Boolean equations
Associate system structure to
a FIGARO "fault tree oriented"
library
yes
yes
no
Dec
reas
ing
com
plexi
ty
or
Associate system structure to an
O3prm library to create a
"Probabilistic Relational Model"
Part 1
Part 2
Part 2
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Outline of part 1
• Introduction of stochastic transitions in Modelica
– A simple test case
– Modeling it using state machines
• Two more complex examples
• Perspectives
5
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015The "Heated room" test case
External temperature
roomT
heater
TE
Heater:
• on at Tmin, off at Tmax
• subject to random failures and repairs
• exponential distributions for times to failure
and times to repair
6
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
An example of single (random) trajectory of T
A failure of the
heater
occurred
somewhere
here
And was repaired at that time
Temperature
of the room
(°C)
Time (h)
This is a PDMP:
Piecewise Deterministic Markov Process7
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Modelica model: structure
equation
der(T)= CoeffHeaterController*HeaterActive +
CoeffOutsideTemperature*(Outside_Temperature - T) ;
THeaterActive
Outside_Temperature
Defined with a hysteresis of the MSL
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015The heater: a first model
algorithm
when initial() then
F := seed; //each calculation of F will yield a pseudo random number
in [0,1]
end when;
// Attention: the two following rules must not be merged in a single one!
when initial() then //calculating the first random working time
F := mod(a*F+c, m);
x := F / m;
X:= (-log(1-x))/lambda;
end when;
when working then //random draw of the next working time
F := mod(a*F+c, m);
x := F / m;
X:= (-log(1-x))/lambda;
end when;
// X is the working time
when working and (time - starttime_working) > X then
working := false;
starttime_notworking := time;
end when;
…. Similar instructions for repairs
// Input-output relation
equation
if working then
y = u;
else
y = 0.;
end if;
Very cumbersome and error prone!
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015The heater (in Modelica 3.3)
We use a continuous time state machine to describe the random
behavior of the heater (only available in Dymola, cf. Modelica
extensions for multi-mode DAE systems, Elmqvist, Mattsson and
Otter, 2014)
Essentially the same
principles as what was
shown on slide "Heater:
a first model", but taking
advantage of abstraction
mechanisms provided by
Modelica.
The user does not have
to write any code
10
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Results: Temperature (10000 random trajectories)
11
time (h)
T(°C)
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Results
• Heated-room
• 1 000 000 sim
• 1h30
0 10 20 30 40 50 60 70 80 90 100
13
14
15
16
17
18
19
20
21
mean low Frac highFrac
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Ex 2 : heated-tank
• Tank with 2 pumps and 1 valve
• Failure rates dependent on temperature
• 2 tied continuous variables : temperature and level
• A test case solved with dozens of methods in the literature!
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Results
• Heated-tank
• 100 000 sim
• 2h15
• Zhang et al. :
1 min 30s
or
23h
0 100 200 300 400 500 600 700 800 900 1000
0.0
0.1
0.2
0.3
0.4
0.5
mean mean mean
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Conclusion
• 3 complementary test cases were solved
• Random state machines work… in Dymola
• Monte Carlo works and is fairly efficient
• Anyway, faster than some other general* methods
*General = that do not use analytical solutions for DAE
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Perspectives
• Apply those principles to a complex system: a data center with
electrical supplies, thermohydraulic cooling system
• Requires the extension of components models with stochastic
state machines to represent failures, repairs, reconfigurations…
• Refine the Monte Carlo function
• Convince the Modelica association to introduce "native"
stochastic transitions in Modelica!
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Various ways to derive stochastic models from Modelica models
17
Need for a reliability/availability analysis of a system already modeled in Modelica
Hybrid?Enrich the model with stochastic
transitions and run MCS
Associate system structure to a
FIGARO state based libraryDynamic?
Boolean?
Create a second
Modelica model using
only Boolean equations
Associate system structure to
a FIGARO "fault tree oriented"
library
yes
yes
no
Dec
reas
ing
com
plexi
ty
or
Associate system structure to an
O3prm library to create a
"Probabilistic Relational Model"
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
The Modelica tools and KB3 work in similar ways
System
Knowledge
base
Modelica
Library
KB3
List of
objects
Figaro
Modelica
System
Flat
Modelica
Figaro 0
Model
Fault tree
generation
Figseq
YAMS
(MCS)
Simulation
18
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Using Modelica in conjunction with the Figaro tools (the binding principle)
Pure ModelicaLibrary Model
Input Figaro
information in
strings
Model + Figaro
information
Extract
Convert
List of objects
Figaro
Knowledge
base Figaro
Figaro processor
Figaro 0 model
Pure Figaro
model M
component component1 (Figaro=”Figaro code”);
component component2 (Figaro="Figaro code”);
equation
connect(component1.y,component2.u)
end M;
19
The mapping between the
classes in Modelica and in
Figaro can be very loose:
each object in the Modelica
model contains the name of
the Figaro class it must be
linked to by the Figaro
processor
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Advantages of using the Figaro language and processor
• Figaro: the first domain specific language for reliability (1990)
• Basis of the KB3 workbench: the reference tool at EDF
• Generic KB thanks to quantifiers
• Two ways to build FT
– The CAT algorithm (Salem 1976) like most nowadays tools
– With macro components => legible and structured FT
• Options to process negations (non coherent FT)
• Ability to produce correct FT for looped systems (cf. telecom
example)
20
S. Salem, G.E. Apostolakis, D. Okrent : "A computer oriented approach to
fault tree construction" EPRI-NP-288. 1976
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Example: telecom network
21
Nominal mode
SourceSource
n1n1
n2n2
targettarget
bidir_1bidir_1
bidir_2bidir_2
bidir_3bidir_3
bidir_4bidir_4
bidir_5bidir_5
R=10R=10
R=10R=10
R=
10
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Example: telecom network
22
Degraded mode
bidir_5
bidir_1
bidir_3
bidir_2
bidir_4
bidir_2
bidir_3
bidir_1 bidir_4
bidir_5
Source
n2
not linked
n1
targetSource
n1
n2
target
R=10R=10
R=10000R=1000
0
R=
1000
0
target.v
n2.v
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Example: telecom network
23
Failure of the mission
bidir_4bidir_1
bidir_5bidir_2
bidir_3
bidir_1
bidir_5
bidir_3
bidir_4
bidir_2
target
not linked
n2
not linkedSource
n1
n2
targetSource
n1
R=10
R=10 R=10000
R=1000
0
R=
1000
0
target.v
n1.v
We want to get the exhaustive list of minimal cut sets,
without trying all combinations of failures in Modelica!
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
24
Telecom network: the FIGARO library
The library is edited in the Visual Figaro editor
Total length: 115 lines
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Example: telecom network Fault tree generated by the FIGARO processor
25
bidir_3_interruption
The link bidir_3 is broken
bidir_1_interruption
The link bidir_1 is broken
9
bidir_3_interruption
The link bidir_3 is broken
162
bidir_5_interruption
The link bidir_5 is broken
bidir_4_interruption
The link bidir_4 is broken
bidir_2_interruption
The link bidir_2 is broken
173
Not n1 is linked to a source
21
Not n2 is linked to a source
Target_not_linked_to_source
Not target is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
bidir_1_interruption
The link bidir_1 is broken
22174
SourceSource
n1n1
n2n2
targettarget
bidir_1bidir_1
bidir_2bidir_2
bidir_3bidir_3
bidir_4bidir_4
bidir_5bidir_5
(considering nodes as perfect to get a small fault tree)
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
It could also work for a more complicated case…
26
Target_not_linked_to_Source
Not Target is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
8658
Not Node_2 is linked to a
source
74478082
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
7446
Not Node_1 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
9701
Not Node_1 is linked to a
source
96489680
bidir_3_interruption
The link bidir_3 is broken
Node_8_fail
Failure of Node_8
Node_2_fail
Failure of Node_2
9647
Not Node_2 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
9922
Not Node_1 is linked to a
source
98699901
ud_4_interruption
The link ud_4 is broken
Node_7_fail
Failure of Node_7
9868
Not Node_2 is linked to a
source
bidir_13_interruption
The link bidir_13 is broken
Node_8_fail
Failure of Node_8
Node_7_fail
Failure of Node_7
9814
Not Node_7 is linked to a
source
96029791
bidir_4_interruption
The link bidir_4 is broken
Node_8_fail
Failure of Node_8
Node_3_fail
Failure of Node_3
9601
Not Node_8 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
9205
Not Node_2 is linked to a
source
87859035
ud_2_interruption
The link ud_2 is broken
Node_3_fail
Failure of Node_3
8784
Not Node_1 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
9465
Not Node_1 is linked to a
source
94129444
bidir_5_interruption
The link bidir_5 is broken
Node_3_fail
Failure of Node_3
Node_2_fail
Failure of Node_2
9411
Not Node_2 is linked to a
source
955587769264
bidir_8_interruption
The link bidir_8 is broken
Node_4_fail
Failure of Node_4
Node_3_fail
Failure of Node_3
8775
Not Node_3 is linked to a
source
bidir_11_interruption
The link bidir_11 is broken
Node_5_fail
Failure of Node_5
Node_4_fail
Failure of Node_4
8755
Not Node_4 is linked to a
source
74268711
ud_3_interruption
The link ud_3 is broken
Node_6_fail
Failure of Node_6
7425
Not Node_5 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
11144
Not Node_1 is linked to a
source
1109111123
bidir_3_interruption
The link bidir_3 is broken
Node_8_fail
Failure of Node_8
Node_2_fail
Failure of Node_2
11090
Not Node_2 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
11395
Not Node_1 is linked to a
source
1134211374
ud_4_interruption
The link ud_4 is broken
Node_7_fail
Failure of Node_7
11341
Not Node_2 is linked to a
source
bidir_13_interruption
The link bidir_13 is broken
Node_8_fail
Failure of Node_8
Node_7_fail
Failure of Node_7
11287
Not Node_7 is linked to a
source
1104511264
bidir_4_interruption
The link bidir_4 is broken
Node_8_fail
Failure of Node_8
Node_3_fail
Failure of Node_3
11044
Not Node_8 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
10618
Not Node_2 is linked to a
source
1016810448
ud_2_interruption
The link ud_2 is broken
Node_3_fail
Failure of Node_3
10167
Not Node_1 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
10878
Not Node_1 is linked to a
source
1082510857
bidir_5_interruption
The link bidir_5 is broken
Node_3_fail
Failure of Node_3
Node_2_fail
Failure of Node_2
10824
Not Node_2 is linked to a
source
109981015910677
bidir_8_interruption
The link bidir_8 is broken
Node_4_fail
Failure of Node_4
Node_3_fail
Failure of Node_3
10158
Not Node_3 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
12481
Not Node_2 is linked to a
source
1159012065
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
11589
Not Node_1 is linked to a
source
bidir_11_interruption
The link bidir_11 is broken
Node_5_fail
Failure of Node_5
Node_4_fail
Failure of Node_4
11569
Not Node_5 is linked to a
source
1013811547
bidir_10_interruption
The link bidir_10 is broken
Node_6_fail
Failure of Node_6
Node_4_fail
Failure of Node_4
10137
Not Node_4 is linked to a
source
741710094
bidir_12_interruption
The link bidir_12 is broken
Target_fail
Failure of Target
Node_6_fail
Failure of Node_6
7416
Not Node_6 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
3428
Not Node_2 is linked to a
source
25373012
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
2536
Not Node_1 is linked to a
source
ud_3_interruption
The link ud_3 is broken
Node_6_fail
Failure of Node_6
2516
Not Node_5 is linked to a
source
bidir_10_interruption
The link bidir_10 is broken
Node_6_fail
Failure of Node_6
Node_4_fail
Failure of Node_4
2506
Not Node_6 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
1083
Not Node_1 is linked to a
source
10301062
bidir_3_interruption
The link bidir_3 is broken
Node_8_fail
Failure of Node_8
Node_2_fail
Failure of Node_2
1029
Not Node_2 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
1334
Not Node_1 is linked to a
source
12811313
ud_4_interruption
The link ud_4 is broken
Node_7_fail
Failure of Node_7
1280
Not Node_2 is linked to a
source
bidir_13_interruption
The link bidir_13 is broken
Node_8_fail
Failure of Node_8
Node_7_fail
Failure of Node_7
1226
Not Node_7 is linked to a
source
9841203
bidir_4_interruption
The link bidir_4 is broken
Node_8_fail
Failure of Node_8
Node_3_fail
Failure of Node_3
983
Not Node_8 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
553
Not Node_2 is linked to a
source
69383
ud_2_interruption
The link ud_2 is broken
Node_3_fail
Failure of Node_3
68
Not Node_1 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
816
Not Node_1 is linked to a
source
763795
bidir_5_interruption
The link bidir_5 is broken
Node_3_fail
Failure of Node_3
Node_2_fail
Failure of Node_2
762
Not Node_2 is linked to a
source
93659614
bidir_8_interruption
The link bidir_8 is broken
Node_4_fail
Failure of Node_4
Node_3_fail
Failure of Node_3
58
Not Node_3 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
2420
Not Node_2 is linked to a
source
15292004
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
1528
Not Node_1 is linked to a
source
bidir_11_interruption
The link bidir_11 is broken
Node_5_fail
Failure of Node_5
Node_4_fail
Failure of Node_4
1508
Not Node_5 is linked to a
source
2482361486
bidir_9_interruption
The link bidir_9 is broken
Target_fail
Failure of Target
Node_4_fail
Failure of Node_4
35
Not Node_4 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
7056
Not Node_1 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
ud_2_interruption
The link ud_2 is broken
Node_3_fail
Failure of Node_3
6299
Not Node_1 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
6650
Not Node_1 is linked to a
source
bidir_11_interruption
The link bidir_11 is broken
Node_5_fail
Failure of Node_5
Node_4_fail
Failure of Node_4
6629
Not Node_5 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
6789
Not Node_1 is linked to a
source
ud_3_interruption
The link ud_3 is broken
Node_6_fail
Failure of Node_6
6768
Not Node_5 is linked to a
source
bidir_10_interruption
The link bidir_10 is broken
Node_6_fail
Failure of Node_6
Node_4_fail
Failure of Node_4
6759
Not Node_6 is linked to a
source
66076737
bidir_8_interruption
The link bidir_8 is broken
Node_4_fail
Failure of Node_4
Node_3_fail
Failure of Node_3
6606
Not Node_4 is linked to a
source
62906560
bidir_5_interruption
The link bidir_5 is broken
Node_3_fail
Failure of Node_3
Node_2_fail
Failure of Node_2
6289
Not Node_3 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
703562687003
ud_4_interruption
The link ud_4 is broken
Node_7_fail
Failure of Node_7
6267
Not Node_2 is linked to a
source
bidir_13_interruption
The link bidir_13 is broken
Node_8_fail
Failure of Node_8
Node_7_fail
Failure of Node_7
6259
Not Node_7 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
4869
Not Node_1 is linked to a
source
48164848
bidir_5_interruption
The link bidir_5 is broken
Node_3_fail
Failure of Node_3
Node_2_fail
Failure of Node_2
4815
Not Node_2 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
3990
Not Node_2 is linked to a
source
36173922
ud_2_interruption
The link ud_2 is broken
Node_3_fail
Failure of Node_3
3616
Not Node_1 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
4332
Not Node_2 is linked to a
source
41374264
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
4136
Not Node_1 is linked to a
source
bidir_11_interruption
The link bidir_11 is broken
Node_5_fail
Failure of Node_5
Node_4_fail
Failure of Node_4
4116
Not Node_5 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
4640
Not Node_2 is linked to a
source
44454572
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
4444
Not Node_1 is linked to a
source
ud_3_interruption
The link ud_3 is broken
Node_6_fail
Failure of Node_6
4424
Not Node_5 is linked to a
source
bidir_10_interruption
The link bidir_10 is broken
Node_6_fail
Failure of Node_6
Node_4_fail
Failure of Node_4
4415
Not Node_6 is linked to a
source
40944393
bidir_8_interruption
The link bidir_8 is broken
Node_4_fail
Failure of Node_4
Node_3_fail
Failure of Node_3
4093
Not Node_4 is linked to a
source
477036084047
bidir_4_interruption
The link bidir_4 is broken
Node_8_fail
Failure of Node_8
Node_3_fail
Failure of Node_3
3607
Not Node_3 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_1_interruption
The link bidir_1 is broken
Node_2_fail
Failure of Node_2
Node_1_fail
Failure of Node_1
5917
Not Node_1 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
ud_2_interruption
The link ud_2 is broken
Node_3_fail
Failure of Node_3
5181
Not Node_1 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
5532
Not Node_1 is linked to a
source
bidir_11_interruption
The link bidir_11 is broken
Node_5_fail
Failure of Node_5
Node_4_fail
Failure of Node_4
5511
Not Node_5 is linked to a
source
ud_1_interruption
The link ud_1 is broken
Node_1_fail
Failure of Node_1
Source_fail
Failure of Source
bidir_6_interruption
The link bidir_6 is broken
Node_5_fail
Failure of Node_5
Node_1_fail
Failure of Node_1
5671
Not Node_1 is linked to a
source
ud_3_interruption
The link ud_3 is broken
Node_6_fail
Failure of Node_6
5650
Not Node_5 is linked to a
source
bidir_10_interruption
The link bidir_10 is broken
Node_6_fail
Failure of Node_6
Node_4_fail
Failure of Node_4
5641
Not Node_6 is linked to a
source
54895619
bidir_8_interruption
The link bidir_8 is broken
Node_4_fail
Failure of Node_4
Node_3_fail
Failure of Node_3
5488
Not Node_4 is linked to a
source
51725442
bidir_5_interruption
The link bidir_5 is broken
Node_3_fail
Failure of Node_3
Node_2_fail
Failure of Node_2
5171
Not Node_3 is linked to a
source
bidir_2_interruption
The link bidir_2 is broken
Source_fail
Failure of Source
Node_2_fail
Failure of Node_2
589651505864
bidir_3_interruption
The link bidir_3 is broken
Node_8_fail
Failure of Node_8
Node_2_fail
Failure of Node_2
5149
Not Node_2 is linked to a
source
623635875129
bidir_7_interruption
The link bidir_7 is broken
Node_8_fail
Failure of Node_8
Target_fail
Failure of Target
3586
Not Node_8 is linked to a
source
739693562
Target
Node_4Node_2
Node_5
Node_6
Source
Node_1
Node_8
Node_3
Node_7
Node_6
Source
Node_3
Node_4Node_2
Node_7
Node_8
Target
Node_5
Node_1
First third of the fault tree…
Generation of a fault tree eliminating
loops by KB3 (failures of nodes and
links taken into account)
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Example 2: thermohydraulic system (SRI)
• Real use case of MODRIO
• Cooling system in a nuclear power plant
27
SRI in Modelica
(library ThermosysPro)
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015The SRI as it would be input in KB3
• The Figaro library (Skelbo) was developed long ago,
independently from the SRI model in Modelica
28
SRI in Figaro (library Skelbo)
380
380
380
!
M
M
M
In fact, the
same
topological
information is
input in the
Modelica
model
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Demonstration: OpenModelica
29
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015The generated fault tree in the GRIF editor
30
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Summary: engineering workflow
31
Modelica library
Modelica system
Functional simulations
Figaro library
• Visual Figaro
Figaro system
• Modelica tool
FT generation
• Figaro processor
FT processing
• GRIF, Risk Spectrum…
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Conclusion of Part 2
• Main advantage of this approach: relies on mature tools and
formalisms
• Smart fault tree generator
– Can use automatically generated macro components
– Handles looped systems properly
• No need to change the Modelica model, nor the Figaro library
• The Figaro and Modelica parts are loosely coupled: no need to
have a bijection between the elements of the two models
• It will be possible to propose an enhanced GUI to help the user
input correct Figaro additions (with pull down menus…)
32
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Perspective: binding the Figaro model to Form-L models
33
Verification model
Requirements
model
Architecture
models
Behavioral modelsH
H
H
H
Engineering
database
FORM-L model
Modelica model
H Observation operator
Instance binding
Class binding
Internal state (dynamic variable)
Static attribute
External function
External data
Component
Dependability model
Figaro
library
Probabilistic
requirements
Probabilistic
requirements
Other
requirements
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
THANK YOU!
Where to find more information on tools:
http://openmodelica.org download OpenModelica with Figaro
text-only tools
http://sourceforge.net/projects/visualfigaro/ download KB3 and
other Figaro based tools
http://marc.bouissou.free.fr/ papers on the principles of Figaro
tools
http://rdsoft.edf.fr then link to KB3: general information on KB3
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
COMPLEMENTS
35
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015
Telecom network: the FIGARO information that must be added in the Modelica model
36
A: The only Figaro code the
user has to input
(for every link)
In the Modelica model, the
class "link" is a subclass of:
• The electrical
component resistor
• The generic class
FIGARO that contains
only two string
parameters A and B
B: The name of the corresponding
class in the FIGARO library is defined
in the class "link"
• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • •
Presentation at DCDS 2015Limitations of the CAT algorithm
37
G. Squellati "Critical review of the CAT algorithms for automated fault
tree construction". JRC technical note N° 1.06.01.80.84. October 1980
With orientation from left to right, in the
generated FT for I3=0, R3 does not appear
With the macro component approach of KB3,
the model states:
- failure of Ri => failure of MC
- failure of MC => Ii = 0
